---
id: CVE-2026-41187
title: >-
  Calico's apiserver wraps tier-scoped resources so that every operation runs
  through AuthorizeTierOperation, but the Delete override on NetworkPolicy,
  GlobalNetworkPolicy, and their staged variants is not invoked for
  DeleteCollection requ…
summary: >-
  Calico's apiserver wraps tier-scoped resources so that every operation runs
  through AuthorizeTierOperation, but the Delete override on NetworkPolicy,
  GlobalNetworkPolicy, and their staged variants is not invoked for
  DeleteCollection requ…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-285
  - CWE-863
vendor: tigera
product: calico
affected:
  - calico < 3.21.7
  - calico < 3.31.6
  - calico <= 22.4.0
  - 'calico >= 3.22.0, < 3.22.4'
  - 'calico >= 3.32.0, < 3.32.1'
patched:
  - calico 3.32.1
published: '2026-07-30'
updated: '2026-08-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41187'
references:
  - url: 'https://github.com/projectcalico/calico/pull/12731'
    label: psirt@tigera.io
  - url: 'https://github.com/projectcalico/calico/pull/12735'
    label: psirt@tigera.io
  - url: 'https://github.com/projectcalico/calico/pull/12736'
    label: psirt@tigera.io
  - url: 'https://github.com/projectcalico/calico/pull/12737'
    label: psirt@tigera.io
  - url: 'https://www.tigera.io/security-bulletins/tta-2026-006/'
    label: psirt@tigera.io
tags:
  - nvd
epss: 0.00388
epssPercentile: 0.30089
ingestedAt: '2026-08-08T13:22:52.550Z'
---

## Overview

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.

## Affected

- `calico < 3.21.7`
- `calico < 3.31.6`
- `calico <= 22.4.0`
- `calico >= 3.22.0, < 3.22.4`
- `calico >= 3.32.0, < 3.32.1`

## Remediation

Upgrade past the affected range:

- `calico 3.32.1`